Access Control Matrix
description
Transcript of Access Control Matrix
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-1
Chapter 2: Access Control Matrix
• Overview• Access Control Matrix Model• Protection State Transitions
– Commands– Conditional Commands
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-2
Overview
• Protection state of system– Describes current settings, values of system
relevant to protection• Access control matrix
– Describes protection state precisely– Matrix describing rights of subjects– State transitions change elements of matrix
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-3
Description
objects (entities)
subj
ects
s1s2
…
sn
o1 … om s1 … sn • Subjects S = { s1,…,sn }• Objects O = { o1,…,om }• Rights R = { r1,…,rk }• Entries A[si, oj] ⊆ R• A[si, oj] = { rx, …, ry }
means subject si has rightsrx, …, ry over object oj
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-4
Example 1
• Processes p, q• Files f, g• Rights r, w, x, a, o
f g p qp rwo r rwxo wq a ro r rwxo
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-5
Example 2
• Procedures inc_ctr, dec_ctr, manage• Variable counter• Rights +, –, call
counter inc_ctr dec_ctr manageinc_ctr +dec_ctr –manage call call call
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-6
State Transitions
• Change the protection state of system• |– represents transition
– Xi |– τ Xi+1: command τ moves system fromstate Xi to Xi+1
– Xi |– * Xi+1: a sequence of commands movessystem from state Xi to Xi+1
• Commands often called transformationprocedures
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-7
Primitive Operations• create subject s; create object o
– Creates new row, column in ACM; creates new column in ACM• destroy subject s; destroy object o
– Deletes row, column from ACM; deletes column from ACM• enter r into A[s, o]
– Adds r rights for subject s over object o• delete r from A[s, o]
– Removes r rights from subject s over object o
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-8
Creating File
• Process p creates file f with r and wpermissioncommand create•file(p, f)
create object f;enter own into A[p, f];enter r into A[p, f];enter w into A[p, f];
end
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-9
Mono-Operational Commands
• Make process p the owner of file gcommand make•owner(p, g)
enter own into A[p, g];end
• Mono-operational command– Single primitive operation in this command
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-10
Conditional Commands
• Let p give q r rights over f, if p owns fcommand grant•read•file•1(p, f, q)
if own in A[p, f]then
enter r into A[q, f];end
• Mono-conditional command– Single condition in this command
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-11
Multiple Conditions
• Let p give q r and w rights over f, if p ownsf and p has c rights over qcommand grant•read•file•2(p, f, q)
if own in A[p, f] and c in A[p, q]then
enter r into A[q, f];enter w into A[q, f];
end
November 1, 2004 Introduction to Computer Security© 2004 Matt Bishop
Slide #2-12
Key Points
• Access control matrix simplest abstractionmechanism for representing protection state
• Transitions alter protection state• 6 primitive operations alter matrix
– Transitions can be expressed as commandscomposed of these operations and, possibly,conditions